linux/poky.git/meta/recipes-support, branch zeus-next

gnutls: CVE-2020-24659

2020-09-10T12:21:41+00:00

Backport the CVE patch from the usptream: https://gitlab.com/gnutls/gnutls.git commit 29ee67c205855e848a0a26e6d0e4f65b6b943e0a (From OE-Core rev: 7a9969fe8cb8b039976bcd482d7b815922ae54ea) Signed-off-by: Zhixiong Chi Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie

acl: Disable parallel make install

2020-09-10T12:21:41+00:00

Similiarly to attr, do_install fails on newer versions of make with interesting and hard to debug errors. Disablle parallle make install as a workaround. Later verisons of acl in newer releases don't have the issue. (From OE-Core rev: 036a4b425f88a237c2c7c1b9575bd2d372a8e130) Signed-off-by: Richard Purdie

attr: Disable parallel make install

2020-09-10T12:21:41+00:00

do_install fails on newer versions of make with interesting and hard to debug errors. Disablle parallle make install as a workaround. Later verisons of attr in newer releases don't have the issue. (From OE-Core rev: 3bea0931087698b9913f56bb93df3ef279ab4930) Signed-off-by: Richard Purdie

libpcre: Add fix for CVE-2020-14155

2020-08-12T09:53:51+00:00

Added below patch in libpcre CVE-2020-14155.patch This patch fixes below error: PCRE could allow a remote attacker to execute arbitrary code on the system, caused by an integer overflow in libpcre via a large number after (?C substring. By sending a request with a large number, an attacker can execute arbitrary code on the system or cause the application to crash. Tested-by: Rahul Taya (From OE-Core rev: 3f536edfa56ce3f93223c23ed48427a0c24ede1a) Signed-off-by: Saloni Jain Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie

nss: Fix CVE-2020-12399

2020-08-04T22:17:38+00:00

Master (nss version 3.54) is not affected by this issue. This is a backport from nss version 3.54. NSS has shown timing differences when performing DSA signatures, which was exploitable and could eventually leak private keys. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR < 68.9. Upstream patch: https://hg.mozilla.org/projects/nss/rev/daa823a4a29bcef0fec33a379ec83857429aea2e (From OE-Core rev: c447b32c1ec0c117748a4be68dda02d375c81b85) Signed-off-by: Ovidiu Panait Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie

sqlite: backport CVE fix

2020-08-04T22:17:38+00:00

Fixes CVE-2020-11655 (From OE-Core rev: 3b06a6c73f4e49c6d00f758423c2e8865ec2de00) (From OE-Core rev: 36edee3e489e7bd94d6fa555f87d94c5ec0f3ad8) Signed-off-by: Sakib Sajal Signed-off-by: Richard Purdie [ without the CVE-2020-11656 fix that did not apply cleanly ] Signed-off-by: Adrian Bunk Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie

iso-codes: switch upstream branch master -> main

2020-08-04T22:17:38+00:00

(From OE-Core rev: 6e16ef0c2e0ec2bbb862231cd84e7650bd5789af) (From OE-Core rev: add9b04f0596ade188224104595406d638a6fa73) Signed-off-by: Hongxu Jia Signed-off-by: Richard Purdie (cherry picked from commit 75e91b8e52ec77398e6b0fc09456e971662d9d7e) Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie

vim: _FORTIFY_SOURCE=2 be gone

2020-08-04T22:17:37+00:00

vim will abort in many places with this setting. Replace it with the benign _FORTIFY_SOURCE=1. (From OE-Core rev: d9de155f6452f916edd3131addd0c2eebaf4d639) (From OE-Core rev: db1e93c33150e712b90e81450fd2e161ea2fad08) Signed-off-by: Joe Slater (cherry picked from commit 18129cbaeddb3278efe9963718556e3765f06c1e) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie Signed-off-by: Adrian Bunk Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie

libexif: fix CVE-2020-13114

2020-08-04T22:17:37+00:00

(From OE-Core rev: 2e497029ee00babbc50f3c1d99580230bc46155c) (From OE-Core rev: 221e42c20148bb57986dfa862b352b9264694003) Signed-off-by: Lee Chee Yang Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie Signed-off-by: Adrian Bunk Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie

gnutls: fixed CVE-2020-13777

2020-07-08T09:47:50+00:00

GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket Backport the patch from upstream: https://gitlab.com/gnutls/gnutls.git commit c2646aeee94e71cb15c90a3147cf3b5b0ca158ca commit 50ad8778a81f9421effa4c5a3b457f98e559b178 commit 3d7fae761e65e9d0f16d7247ee8a464d4fe002da (From OE-Core rev: 86870cd2ff3555161ea5bb434740338ec20495a0) Signed-off-by: Haiqing Bai Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie